As it is known by the man skilled in the art, some electronic devices generate messages that are intended to be transmitted to other electronic devices, for instance for controlling functions and/or rights (such as access or credits). To avoid a non-authorized electronic device to transmit a non-authorized message, a bijective algorithm can be applied with at least one predetermined key to this message before transmission. This bijective algorithm may comprise a ciphering or cryptographic algorithm that is successively applied to N blocks of data resulting from the division of the message, for instance.
The result of this application is a code, which is generally called MAC (“Message Authentication Code”). This code and the associated message are transmitted to the concerned electronic device. To authenticate this received code, the electronic device applies the same bijective algorithm with the same predetermined key to the received message in order to get a reference code. If this reference code is identical to the received code, the latter is considered as authentic and the message can be used, otherwise the message is rejected.
Unfortunately, such a bijective algorithm may be attacked by an attacker to get each predetermined key it uses and therefore becoming capable of transmitting any authorized message. So, this attacker may transmit successively the same message with different codes to an electronic device to make it compute reference codes that it will have to compare respectively to the received codes, and then may deduce each predetermined key from these successive comparisons and from physical effect variations occurring into the attacked electronic device. It is recalled that some internal operations or processes may be recognized by characteristic physical effects, such as a specific power consumption, a specific temperature or a specific electromagnetic interaction, for instance.
Attacks based on power consumption analysis (generally called DPA (“Differential Power Analysis”)) may be performed either on starting steps of the bijective algorithm or on ending steps of the bijective algorithm. The first ones (generally called “DPA by the beginning”) are relatively easy to block, for instance with specific countermeasures. The second ones (generally called “DPA by the end”) are much more difficult to block. They may be carried out when the attacker knows the code (or submitted MAC) that is received by the attacked electronic device, because he becomes capable of learning the result of the application of the ciphering or cryptographic algorithm that is used into the bijective algorithm. This second type of attacks is facilitated by the fact that the computed reference code is compared byte by byte to the received code (or submitted MAC).